#pamstealer · Elektrine

CyberWorldOps @cyberworldops@infosec.exchange

· 2w ago

Jamf Threat Labs found a PamStealer macOS variant that withholds its main payload until live X25519 key exchange and server-assisted decryption. This blocks offline analysis and relies on AppleScript, JXA and zsh loaders with multi-layer persistence. Hunt for JXA execution and anomalous C2 sessions. #PamStealer #MacOSMalware #ThreatIntel https://cyberworldops.eu/en/pamstealer-makes-macos-payload-recovery-depend-on-its-command-server

PamStealer macOS Malware Uses Live C2 Decryption

PamStealer macOS Malware Uses Live C2 Decryption

New PamStealer macOS variant uses fake Wavel wallet, JXA-to-zsh chain and server-side X25519 decryption to deliver Swift password stealer.

0

0

0

0

The New Oil @thenewoil@mastodon.thenewoil.org

· 3mo ago

Newly discovered #PamStealer isn’t your typical #macOS #malware https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/ #cybersecurity #apple #infostealer

Newly discovered PamStealer isn't your typical macOS malware

Newly discovered PamStealer isn't your typical macOS malware

The discovery underscores the increased effort being poured into Mac infostealers.

0

0

3

0

You've seen all posts